178,000 SonicWall firewalls are vulnerable to old DoS bugs

Updated More than 178,000 SonicWall firewalls are still vulnerable to years-old vulnerabilities, an infosec reseacher claims. A study by Jon Williams, senior security engineer at Bishop Fox, this week highlights what he refers to as weapons-grade patch apathy from SonicWall customers, with the number of exploitable devices representing 76 percent of those that are public-facing. With a focus on CVE-2022-22274 and CVE-2023-0656 specifically, Williams said 178,637 of 233,984 public-facing SonicWall next-generation firewall (NGFW) series 6 and 7 devices are vulnerable to one or both of these flaws. Both vulnerabilities lead to denial of service (DoS), but the former is easily the most serious since it can also potentially lead to remote code execution (RCE), earning it a near-maximum 9.8 severity score for its exploitability and potential impact. "Our research found that the two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern," said Williams. SSD Labs previously stated that in both cases, cybercrims are “tasked with exploiting a stack overflow vulnerability to cause the DoS - remotely carried out by sending a malicious HTTP request. “The specific flaw exists within the httpServer function,” it added. “The issue results from the lack of checking the return result of snprintf before using it to calculate the maximum length. An attacker can leverage this vulnerability to impact the availability of the target se...